ZeroDay Findings
Sign inSign up

Findings

CVE-2021-41617

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initializ…

Published Sep 26, 2021 · updated Oct 14, 2026 · openbsd openssh

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 26, 2021 · NIST NVD

    Detected

    sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a differen

  2. Oct 14, 2026 · NIST NVD

    Updated

    sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a differen

Affected

  • cpe fedoraproject/fedora33
  • cpe fedoraproject/fedora34
  • cpe fedoraproject/fedora35
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/aff 500f firmwareversion unspecified
  • cpe netapp/aff a250 firmwareversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe openbsd/opensshversion unspecified
  • cpe oracle/http server12.2.1.2.0
  • cpe starwindsoftware/starwind virtual sanv8r13

Sources

  • CVE.orgVulnerability recordCVE-2021-41617

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-41617

    30-day exploitation probability 2.5%

    first.org
  • NIST NVDVulnerability recordCVE-2021-41617

    sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges

    nvd.nist.gov

References